Tech Risk

ai.greyridgesignals由 greyridgesignals.ai 發布官方發布者v0.1.7更新於 Nov 4, 2026

MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/LLM08), x402-payable

已驗證Streamable HTTP可網頁執行金融開發者工具安全與監控

概覽

AI 產生的概覽

為 AI 代理提供的按次付費 x402 資料與安全 API：MCP 工具投毒掃描、x402 付款預檢與回執核驗、Base 鏈上讀取，以及加密與 DeFi 行情資料。

可以做什麼
  • 掃描 MCP 伺服器的工具投毒與提示注入，提供免費計數預覽與付費逐項稽核
  • 付款前檢查 x402 端點，付款後核驗 Base 上的 USDC 結算回執
  • 依 OFAC 與詐騙名單篩查 Base 錢包，並讀取餘額、Gas、區塊與交易
  • 評估 Base ERC-20 代幣與兌換，給出蜜罐、跑路風險及 GO/HOLD/BLOCK 交易前結論
  • 取得加密現貨價格、跨交易所資金費率、DeFi 收益池與 Polymarket 預測市場
  • 對網域做技術堆疊指紋、CVE/EPSS/KEV 風險與子網域列舉等情資補充
適用情境
適合代理需要為 x402 端點付費、因而要做付款前與結算核驗的情境；也適合稽核某個 MCP 伺服器工具是否藏有隱藏指令，或在 Base 上交易、篩查代幣與錢包。多數介面都有免費預覽，可先試用再決定是否付費。
執行需求
可連線遠端 streamable-HTTP 端點，或透過 uvx 從 greyridge-x402-tools 的 PyPI 套件（或 npm 用戶端）在本機以 stdio 執行。不需帳號或 API 金鑰。付費工具需透過支援 x402 的用戶端在 Base 主網以 USDC 按次微付款；免費預覽工具無需付款。需要能連上其託管 API 的網路。
安裝前請注意
付費工具每次呼叫都會花費真實 USDC（約 0.001 至 0.05 美元），代理需準備有餘額的錢包並設定支出上限。選用的本機用戶端若在 X402_WALLET_PRIVATE_KEY 設定錢包私鑰，會自動完成付款；留空則只能使用免費工具。掃描與情資補充會把目標 URL 或網域送到第三方服務，且結論僅為就緒性訊號，並非安全保證。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Tech Risk，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/ai.greyridgesignals%2Ftech-risk/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "tech-risk": {
      "type": "http",
      "url": "https://api.greyridgesignals.ai/mcp"
    }
  }
}

README

Grey Ridge Signals — Agent-Native x402 Data & Security APIs

Pay-per-call crypto, DeFi, prediction-market, and on-chain data for AI agents — plus MCP security scanning — over the x402 payment protocol on Base mainnet.

No account, no API key, no subscription. An agent pays inline in USDC (from $0.001/call) and gets the data back in the same request. Every data endpoint has a free preview so an agent can taste the payload before paying.

  • Base URL: https://x402-data-api.sigrunner.workers.dev
  • MCP endpoint (streamable-http): https://x402-data-api.sigrunner.workers.dev/mcp
  • Canonical domain: https://x402-data-api.sigrunner.workers.dev (same API)
  • Discovery: /.well-known/x402 · /openapi.json · /llms.txt
  • Network: Base mainnet (eip155:8453), USDC. Settles via the non-custodial xpay facilitator — no Coinbase/CDP account needed. Also listed on the CDP x402 Bazaar.

Two flagships — what agents actually pay for

  1. MCP server security scan (/scan/mcp, $0.05) — a prompt-injection / tool-poisoning audit of an MCP server's tools (OWASP LLM01/LLM08). Zero-egress: for private/OAuth-gated servers you POST only the tools/list JSON — nothing else leaves your side. There is no free equivalent for this (unlike token-safety, where free multi-chain scanners exist). Free preview: POST /scan/mcp/preview. CI gate (on the GitHub Marketplace): uses: rezearcher/[email protected].
  2. Pre-trade decision gate (/gate/swap, $0.008 · /chain/token-report, $0.01) — a decision (GO/HOLD/BLOCK, SAFE/CAUTION/AVOID) sized to your trade, not raw flags your agent has to interpret. Base-native; if you trade other chains, keep your multi-chain scanner and use this on Base.

Everything below is the full catalog (crypto/DeFi data, on-chain reads, LLM, enrichment). Measured reliability at /status (not an SLA).

Endpoints

Crypto & DeFi data

EndpointPriceReturns
GET /crypto/prices?coins=bitcoin,ethereum,solana$0.001Spot token prices (DefiLlama), keyless. Up to 25 CoinGecko ids.
GET /crypto/funding?limit=20$0.001Cross-venue perp funding rates (Hyperliquid + OKX, graceful fallback) with the funding spread + best long/short venue — the arb signal, not just a single-venue list.
GET /defi/yields?limit=20&project=&chain=&stable=$0.001Top DeFi lending/LP yields (DefiLlama) with APY breakdown, 7d/30d APY trend, IL risk, and DefiLlama's stability forecast — decision-grade, not a raw list.
GET /pm/markets?query=&limit=20$0.005Live Polymarket prediction markets: question, outcomes, prices, volume, liquidity, end date.

Base on-chain (JSON-RPC read primitives)

Base-native, multi-provider RPC with automatic failover (never fails a paid call on one provider's rate limit).

EndpointPriceReturns
GET /chain/block-number$0.001Current Base block number
GET /chain/gas-price$0.001Current gas price (wei + gwei)
GET /chain/balance?address=$0.001Native ETH balance
GET /chain/token-balance?address=&token=$0.001ERC-20 token balance
GET /chain/tx?hash=$0.001Transaction details
GET /chain/receipt?hash=$0.001Transaction receipt (status, gas used, logs)
GET /chain/code?address=$0.001Contract-code check — is it a contract, and EIP-7702 delegated-EOA detection (is_eip7702_delegate / delegate_address)
GET /chain/wallet?address=$0.003Bundle: ETH balance + tx count + contract flag in one call, EIP-7702 delegated-EOA aware (is_eip7702_delegate / delegate_address)

Agent trading gates (new)

EndpointPriceReturns
GET /gate/swap?token=0x…&side=buy|sell&notional_usd=N$0.008Pre-trade go/hold/block decision for any Base ERC-20: safety verdict, risk score, pool liquidity and price-impact of your size, flags. One call before an agent swaps. Free live sample: /gate/swap/preview
GET /chain/token-report?token=0x…see /openapi.jsonFull token due-diligence report (security + liquidity + metadata) in one call

Security

EndpointPriceReturns
GET /scan/mcp?url=$0.05Security audit of a target MCP server: tool-poisoning / prompt-injection / exfiltration / dangerous-capability / hidden-unicode (OWASP LLM01/LLM08) + risk score
POST /scan/mcp {"tools":[…]}$0.05Zero-egress audit — paste your own tools/list array; same itemized findings, nothing leaves your side and we never fetch/call your server. For OAuth-gated or private MCP servers that won't expose a URL
GET /enrich/tech-risk?domain=$0.05Tech-stack fingerprint → CVE (NVD) + EPSS + CISA-KEV attack-surface risk
GET /enrich/domain?domain=$0.01Firmographic + tech-stack enrichment, incl. full subdomain enumeration (subdomains[]) via crt.sh certificate-transparency logs, RDAP, DoH, HTTP fingerprint

x402 payment verification (before and after your agent pays)

EndpointPriceReturns
GET /x402/preflight?url=$0.001Pre-pay check on any x402 endpoint: will it settle, is the payee safe (OFAC / scam lists), price accuracy, delivery readiness, liveness → PAY / CAUTION / AVOID
GET /x402/receipt-verify?tx=&url=$0.004Post-pay proof: reads the Base settlement tx from two independent RPCs and reconciles the USDC Transfer against the endpoint's own live 402 (payTo + amount) → SETTLED / UNDERPAID / WRONG_RECIPIENT / NO_TRANSFER / REVERTED / NOT_FOUND / UNVERIFIED

Free in MCP: x402_receipt_verify_preview (tx + payto, no payment).

Python agents, no key or wallet: uvx --from greyridge-x402-tools greyridge-x402-verify runs a local stdio MCP server (PyPI 0.6.0) with free x402_preflight and x402_receipt_verify tools. Add it to Claude Desktop/Cursor as command uvx, args --from greyridge-x402-tools greyridge-x402-verify.

Try it now, no key: curl "https://api.greyridgesignals.ai/x402/preflight/preview?url=https://api.greyridgesignals.ai/defi/yields" returns verdict: PAY, will_settle: true with the per-check detail (reachability, challenge, accepts, price accuracy, delivery).

Drop-in safe pay wrapper (free preflight, refuses AVOID, then dual-RPC receipt check on the settlement tx):

  • Python: pip install greyridge-x402-tools (0.7.0), from greyridge_x402.safe_fetch import safe_fetch
  • Node: npm install github:rezearcher/greyridge-x402-tools, import { safeFetch, PreflightBlocked } from "greyridge-x402-tools" (pass your own x402 fetch, e.g. wrapFetchWithPayment)

Already paying with @x402/fetch, wrapFetchWithPayment or a payer MCP such as Crypto APIs' x402_pay? Those pay and hand back the response body; none of them checks that the settlement tx actually moved the advertised amount to the advertised payTo. Keep your payer, and add the verify step after it: pass the tx hash from the X-PAYMENT-RESPONSE header and the URL you paid to x402_receipt_verify. It returns SETTLED, UNDERPAID, WRONG_RECIPIENT, NO_TRANSFER, REVERTED or NOT_FOUND. The x402 FAQ tells buyers to check the transaction themselves; this is that check, in one call.

How x402_receipt_verify differs from the read-only verifier @tensorfeed/x402-base-mcp (verify_x402_settlement, checked against its 0.2.1 README): theirs matches a Transfer against a recipient and amount the caller types in. Ours can pull payTo and amount from the endpoint's live 402 (?url=), so a wrong or stale expectation doesn't pass, and it compares two RPC providers and fails closed if they disagree. Theirs is a good fit if you just want generic Base reads (balances, eth_call) in the same server; ours only does verification.

Free previews: GET /crypto/prices/preview, /crypto/funding/preview, /defi/yields/preview, /chain/block-number/preview, /chain/gas-price/preview (full live data, not truncated), /scan/mcp/preview?url=. Zero-egress MCP scan (for private/OAuth-gated servers): POST /scan/mcp/preview with {"tools":[…]} is the free counts-only preview; POST /scan/mcp with the same body is the paid itemized scan — nothing leaves your side. One-liner: examples/mcp-scan-preview.sh.

MCP server (the pull channel)

Add one remote MCP server and your agent gets the whole toolset. initialize and tools/list are free so agents can discover the tools; paid tools/call returns an x402 challenge.

tools/list advertises 22 tools: crypto_prices, crypto_funding, defi_yields, pm_markets, chain_block_number, chain_gas_price, chain_balance, chain_token_balance, chain_tx, chain_wallet, chain_token_security (paid Base RPC + data, EIP-7702 delegated-EOA aware), crypto_prices_preview, crypto_funding_preview, defi_yields_preview, pm_markets_preview, chain_block_number_preview, chain_gas_price_preview, chain_token_security_preview (free), and scan_mcp_server, scan_mcp_preview, enrich_tech_risk, enrich_domain (security).

jsonc
// add to your MCP client config{  "mcpServers": {    "grey-ridge-x402": {      "type": "streamable-http",      "url": "https://x402-data-api.sigrunner.workers.dev/mcp"    }  }}

MCP client (mcp-client/ — the stdio companion)

For stdio-only MCP clients (Claude Desktop, Cursor, CLI agents), the repo ships a companion package, x402-data-api-mcp, in mcp-client/. It runs on the agent's own machine, speaks MCP over stdio, and proxies to the same Worker /mcp endpoint — it adds no data surface, just a transport + x402 payment shim so stdio-only clients can reach the same tools (22 tools, including paid ones when a wallet key is configured).

Install / run (local path). The package is not yet published to npm, so run it from the repo:

bash
cd mcp-clientnpm installnpm run build          # tsc → dist/server.jsnode dist/server.js    # start (or: npm start)

Published path (one line, no clone): npx @grey-ridge/x402-data-api-mcp — the package is live on npm; its bin target is dist/server.js, so npx runs the same server.

Configuration. Copy mcp-client/.env.example to .env in mcp-client/: WORKER_BASE_URL defaults to the deployed Worker (set it only to point at your own mirror), and X402_WALLET_PRIVATE_KEY is optional — set it to auto-settle paid tools (HTTP 402) via x402; leave it empty to run only the free/preview tools. The client reads both straight from process.env at startup.

jsonc
// stdio client config (local path){  "mcpServers": {    "grey-ridge-x402-local": {      "command": "node",      "args": ["/absolute/path/to/mcp-client/dist/server.js"]    }  }}

Call it (HTTP)

bash
BASE=https://x402-data-api.sigrunner.workers.dev
# free preview — real sample, no paymentcurl -s "$BASE/crypto/funding/preview"
# paid — returns HTTP 402 with an x402 payment-required challenge until you attach paymentcurl -i "$BASE/crypto/funding?limit=10"

Any x402-capable client (e.g. the x402 libraries) handles the 402 → sign → retry automatically.

Measured status

Uptime and latency per safety route are measured from a probe cron and published in docs/STATUS.md (regenerated hourly; window stated in the file, not an SLA).

How it runs

A single Cloudflare Worker implements every HTTP endpoint and the MCP server behind a method-aware x402 gate. All upstreams are free/keyless public APIs (DefiLlama, Hyperliquid, OKX, Polymarket Gamma, Base JSON-RPC, NVD/EPSS/CISA-KEV, crt.sh/RDAP/DoH); every address/hash/domain input is validated and SSRF-guarded (fixed upstream hosts, no user-supplied targets except the explicitly-scoped /scan/mcp and enrichment endpoints).

License

MIT — see LICENSE.

Agent-framework plugins (published)

Pre-trade token guard (/gate/swap, $0.008 USDC via x402 on Base) — drop-in, fails closed, pays inline per call (no API key, no account). Free sample: curl "https://x402-data-api.sigrunner.workers.dev/gate/swap/preview?token=degen"

FrameworkInstallSource
ElizaOSnpm i github:rezearcher/plugin-swap-gateintegrations/elizaos-plugin-swap-gate
LangChain.jsnpm i github:rezearcher/langchain-swap-gate @langchain/core zodintegrations/langchain-swap-gate
Vercel AI SDKnpm i github:rezearcher/vercel-ai-swap-gate ai zodintegrations/vercel-ai-sdk-swap-gate

Install from git — this always pulls the current build (keyless free preview + inline x402, fails closed only if both are unreachable) and compiles on install via prepare. Each also exposes a tokenReport tool wrapping /chain/token-report for standalone token screening. Minimal copy-paste examples live under docs/examples/{swap-gate,langchain,elizaos}/.

Market-data buyer (for agents that buy a price and must not present stale data as real-time — the Decision402 pattern): examples/market-data-decision-buyer.mjs. Runs the full agentic loop — reads the live 402 quote, enforces a per-call USDC budget, proves the feed via the free preview, pays /crypto/prices ($0.001 on Base), then rejects any row older than MAX_AGE_SECONDS. Steps 1-3 run with zero npm installs: node examples/market-data-decision-buyer.mjs bitcoin,ethereum.

Python / LangChain / CrewAI

pip install "git+https://github.com/rezearcher/greyridge-x402-tools" — token_report() and swap_gate() helpers (free preview by default, paid x402 mode optional) plus LangChain tools. Guides: https://rezearcher.github.io/greyridge-x402-tools/

Try it on YOUR token, free

curl "https://x402-data-api.sigrunner.workers.dev/chain/token-report/preview?token=0xYourBaseToken" returns the same full-depth report as the paid route ($0.01). /gate/swap/preview?token=0x… gives 3 free real-token GO/HOLD/BLOCK checks/day/IP.

Agent skill (drop-in SKILL.md for OpenClaw/Hermes-style agents): https://github.com/rezearcher/greyridge-token-safety-skill

CI gate for MCP servers

uses: rezearcher/[email protected] with url: runs the free MCP tool-poisoning preview in CI and fails on a block verdict. Every run also emits a copy-paste README injection-security badge (badge-markdown output / step summary; commit-badge: true auto-commits it between <!-- grsg-badge:start --> markers, degrade-open) — the OWASP-MCP (LLM01/LLM08) dimension generic repo-quality badges omit, re-checked on every CI run and linked to the server's live security report. Listed on the GitHub Marketplace. See actions/mcp-scan/README.md.

Python note: the default Python-urllib User-Agent is rejected with 403 at the Cloudflare edge. Use requests/httpx, or set any custom User-Agent header.

來源：README.md，提交 762bab1

工具

34

enrich_tech_risk

Security enrichment: tech-stack fingerprint + CVE mapping + EPSS + CISA KEV + verdict (clear/review/block) for a domain. Cost: $0.005 USDC per call (x402 micropayment).

輸入參數domaintechstack

enrich_domain

Firmographic + tech-stack enrichment: RDAP registrant/registrar, DNS records, full subdomain enumeration + certificate-transparency history, tech-stack fingerprint, verdict (clear/review/block, based on domain age) for a domain. Cost: $0.005 USDC per call via the shared MCP payment gate (the direct HTTP endpoint GET /enrich/domain is $0.01 — MCP tools/call is gated at a flat $0.005 per request).

輸入參數domain必填

scan_mcp_server

Security-audit a target MCP server for prompt-injection / tool-poisoning. Fetches the server's advertised tools and statically analyzes each for hidden instructions, data-exfiltration hints, dangerous capabilities, cross-tool shadowing, and invisible-unicode payloads (OWASP LLM01/LLM08). Returns findings + a 0-100 risk score + verdict (clear/review/block). Cost: $0.005 USDC per scan via x402 (GET /scan/mcp HTTP variant is $0.05).

輸入參數url必填

scan_mcp_preview

FREE preview scan of a target MCP server for tool-poisoning / prompt-injection. Returns issue count, severity breakdown, risk score, and verdict (clear/review/block) — but NOT which tools or the evidence. Use this to check any MCP server (including your own) at no cost; if issues are found, call the paid scan_mcp_server for the itemized findings + remediation. No payment required.

輸入參數url必填

crypto_prices

Live spot token prices (price, change_24h, symbol, confidence, timestamp) for CoinGecko ids, sourced from DefiLlama. Cost: $0.005 USDC per call via x402.

輸入參數coins

crypto_funding

Live 6-venue perpetual-futures funding rates from Binance+Bybit+OKX+Hyperliquid+dYdX+Gate (per-venue rate, per-venue open interest in USD, an OI-WEIGHTED CEX↔DEX arb verdict — funding_spread_bps + cheapest-long/richest-short venue computed over an OI-screened set so a thin-book outlier never names an unexecutable venue; excluded_thin_venues + oi_weighted flag report what was screened — premium/basis, annualized_hl/okx/binance/bybit/gate, LONGS_PAY/SHORTS_PAY/NEUTRAL signal, next_funding_ts, mark/oracle price, day volume), ranked by volume. Venues unreachable or not listing a coin are omitted per-coin — Hyperliquid is always present. Cost: $0.004 USDC per call via x402.

輸入參數limit

defi_yields

Live DeFi lending/LP yield pools (project, chain, symbol, pool id, APY breakdown incl. 1d/7d/30d trend + apyBase7d/apyMean30d, IL risk incl. il7d, exposure, reward/underlying tokens, outlier flag, mu/sigma, DefiLlama stability forecast, TVL, stablecoin flag) from DefiLlama, ranked by TVL (or risk-adjusted APY = apy/sigma). Cost: $0.005 USDC per call via x402.

輸入參數sortchainlimitstableproject

yield_entry_verdict

Per-pool DeFi yield-entry go/no-go. Pass a DefiLlama poolId (the 'pool' field from defi_yields) and get a packaged SUSTAINABLE | DECAYING | OUTLIER | AVOID verdict + 0-100 risk score + field-cited reasons, built from the pool's APY trend (1d/7d/30d), DefiLlama stability forecast, impermanent loss (il7d), volatility (sigma), outlier flag and TVL. Optional token (0x underlying, Base) adds a honeypot-check pointer. The should-I-enter-THIS-pool call after defi_yields. Cost: $0.01 USDC per call via x402.

輸入參數pool必填token

simulate

Will this Base transaction revert? Prospective-tx dry-run via eth_simulateV1: pass from, to, optional data (0x calldata) and value (wei) and get will_revert + revert_reason + gas_used + token asset_changes BEFORE the agent spends gas sending it. Keyless, Base-native, Tenderly/Alchemy-class output with no API key. Use before a swap/approve/transfer or alongside gate_swap. Cost: $0.005 USDC per call via x402.

輸入參數to必填datafrom必填value

pm_markets

Live Polymarket prediction-market data — question, outcomes, outcome prices, bestBid/bestAsk/spread, volume24hr/volume1wk, oneDayPriceChange, clobTokenIds, conditionId, category tags, liquidity, end date — ranked by volume24hr. Cost: $0.005 USDC per call via x402.

輸入參數limitquery

crypto_prices_preview

FREE 1-item sample of live token prices. No payment required.

無需輸入參數。

crypto_funding_preview

FREE 1-item sample of live cross-venue funding rates. No payment required.

無需輸入參數。

defi_yields_preview

FREE 1-item sample of live DeFi yield pools. No payment required.

無需輸入參數。

yield_entry_verdict_preview

FREE sample yield-entry verdict for the current top-TVL pool. Shows the packaged SUSTAINABLE/DECAYING/OUTLIER/AVOID + risk-score output shape before you pay. No payment required.

無需輸入參數。

simulate_preview

FREE sample prospective-tx dry-run (benign 0-value call) showing the will_revert/gas_used/asset_changes output shape before you pay. No payment required.

無需輸入參數。

pm_markets_preview

FREE top-1 sample of live Polymarket prediction markets, ranked by volume24hr. No payment required.

無需輸入參數。

chain_block_number

Current Base mainnet block number via multi-provider JSON-RPC (automatic failover across 4 providers, never fails on one provider's rate limit). Cost: $0.005 USDC per call via x402.

無需輸入參數。

chain_gas_price

Current Base mainnet gas price (wei/gwei), EIP-1559 base_fee_gwei/priority_fee_gwei, and gas_price_usd (ETH price cross-call — no price oracle on ETH-only competitors) via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.

無需輸入參數。

chain_balance

Native ETH balance of a Base mainnet address, incl. balance_usd (ETH price cross-call — no price oracle on ETH-only competitors), via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.

輸入參數address必填

chain_token_balance

ERC-20 token balance of a Base mainnet address via multi-provider JSON-RPC, incl. symbol/decimals/balance_formatted (per-token-contract cached in-isolate). Cost: $0.005 USDC per call via x402.

輸入參數token必填address必填

chain_tx

Transaction details by hash on Base mainnet via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.

輸入參數hash必填

chain_wallet

Wallet screening bundle (balance, activity, contract vs EOA check): ETH balance + balance_usd (ETH price cross-call) + tx count + contract-code check (EIP-7702 delegated-EOA aware) for a Base mainnet address, in one call. Cost: $0.005 USDC per call via x402.

輸入參數address必填

chain_wallet_screen

Is this wallet sanctioned OR a known scammer? Pre-trade screen for a counterparty / recipient / token-spender address before an agent sends, swaps or approves: exact match against (1) the U.S. Treasury OFAC SDN crypto-address list and (2) community scam/phishing/wallet-drainer threat-intel (ScamSniffer + MEW darklist). Returns sanctioned (bool) + malicious (bool) + verdict (blocked/clear) + the list sources and snapshot dates. 'clear' means not on these lists — not a safety guarantee. Cost: $0.004 USDC per call via x402.

輸入參數address必填

x402_preflight

Should an agent pay this x402 endpoint? Pre-payment check of an UNKNOWN x402 URL: fetch it once (never pays) to validate the 402 challenge + accepts[] (scheme/network/payTo/amount/asset/resource = will it settle) AND label its LIVENESS (LIVE | ZOMBIE | DEAD — is it a working payable endpoint right now, or listed-active-but-broken) AND flag an absolute PRICE TRAP (a honeypot charging >= $1,000/call trips AVOID even when its advertised==live price looks self-consistent; pass max=<usdc> for your own budget ceiling) AND scan the resource + any advertised MCP tools for LLM01/LLM08 prompt-injection and screen payTo against the OFAC SDN + community scam lists (safe to pay) AND verify the PRICE — does the live accepts[].amount match the advertised price? pass advertised=<usdc> (the figure your catalog quoted) or it self-checks the endpoint's /.well-known/x402: MATCH | OVERCHARGE | UNDERCHARGE. Optional samples=N (1-5) runs a reliability/payability burst (settle-consistency + latency; a flapping endpoint downgrades PAY to CAUTION). Returns verdict PAY | CAUTION | AVOID + per-check fix hints + latency. Read-only, never a settlement guarantee. Cost: $0.001 USDC per call via x402.

輸入參數maxurl必填samplesadvertised

x402_receipt_verify

Did my x402 payment actually settle? POST-payment on-chain proof — the other half of x402_preflight (which checks BEFORE paying). Bring your Base settlement tx hash + the resource URL you paid, and this reads the tx receipt from Base mainnet, decodes its USDC Transfer events, and reconciles them against the endpoint's advertised payTo + amount (resolved from the resource's live 402, or pass payto/expect to bind it directly). Returns verdict SETTLED | UNDERPAID | WRONG_RECIPIENT | NO_TRANSFER | REVERTED | NOT_FOUND | UNVERIFIED, the matched transfer, and all USDC transfers in the tx. Read-only ground truth; confirms settlement to the right address + amount, not off-chain resource delivery. Cost: $0.004 USDC per call via x402.

輸入參數tx必填urlpaytoexpect

x402_receipt_verify_preview

FREE keyless x402 settlement check on Base: pass a tx hash plus payto (and optionally expect, in USDC). Dual-RPC reads the receipt, decodes USDC Transfers and returns SETTLED | UNDERPAID | WRONG_RECIPIENT | NO_TRANSFER | REVERTED | NOT_FOUND. Binds to the payTo you supply; resolving the payTo from a live 402 url is the paid x402_receipt_verify.

輸入參數tx必填payto必填expect

chain_token_security

Token security / honeypot detector for a Base mainnet ERC-20: EIP-1967/1822 proxy + upgradeability detection, bytecode dispatcher scan for mint/pause/blacklist/fee-setter/ownership selectors, owner() renouncement check, and a live eth_call state-override simulation testing whether a synthetic wallet can actually transfer() the token. Returns risk_score (0-100) + verdict (clear/review/block) + human-readable flags. Real compute an agent can't trivially self-serve. Cost: $0.005 USDC per call via x402.

輸入參數token必填

chain_block_number_preview

FREE live sample of the current Base mainnet block number — identical data to the paid chain_block_number tool. No payment required.

無需輸入參數。

chain_gas_price_preview

FREE live sample of the current Base mainnet gas price — identical data to the paid chain_gas_price tool. No payment required.

無需輸入參數。

chain_token_report

Token security check (honeypot detector + rug-pull risk score) for a Base ERC-20 in one call, decision-grade trade-safety verdict: SAFE | CAUTION | AVOID plus risk_score (0-100) and reasons, bundling honeypot/sellability simulation, owner-renounced + mint/pause/blacklist/fee-setter/upgradeable-proxy checks, token symbol/name/decimals, and Uniswap v3 WETH-pool liquidity (USD). Replaces many RPC calls and prevents a bad trade. Cost: $0.005 USDC per call via the shared MCP payment gate (the direct HTTP endpoint GET /chain/token-report is $0.01 — MCP tools/call is gated at a flat $0.005 per request).

輸入參數token必填

gate_swap

Pre-trade GO / HOLD / BLOCK gate for a Base ERC-20 swap: honeypot/sellability + admin-control checks + Uniswap v3 liquidity vs. your trade size. Returns a top-level `sized_verdict` one-liner (decision + pool-depth % + max-safe size + round-trip breakeven + exit recovery, read in one shot) AND the full decision-grade sizing — per $100 / $1k / $10k / $50k (and your exact notional_usd): entry-slippage + exit-simulation (net USD recovered vs lost to slippage), round-trip breakeven move %, and max_safe_notional_usd. Cost: $0.005 USDC per call via the shared MCP payment gate (the direct HTTP endpoint GET /gate/swap is $0.008 — MCP tools/call is gated at a flat $0.005 per request).

輸入參數sidetoken必填notional_usd

gate_swap_preview

FREE live sample of the gate_swap pre-trade GO/HOLD/BLOCK decision for a demo Base token (usdc|weth|cbbtc|aero|degen), same shape as the paid gate_swap tool. The paid gate_swap tool additionally returns a top-level `sized_verdict` one-liner plus the full `sizing` object (entry/exit slippage simulation + round-trip breakeven + max_safe_notional_usd); the `paid_adds` block here names those fields. No payment required.

輸入參數sidetokennotional_usd

chain_token_report_preview

FREE full real trade-safety report (SAFE/CAUTION/AVOID verdict) for Base USDC, same depth as the paid chain_token_report tool. No payment required.

無需輸入參數。

chain_token_security_preview

FREE full real analysis of a fixed well-known token (Base WETH) via the token security / honeypot detector — same depth as the paid chain_token_security tool, so you can see the real product before paying. To analyze an arbitrary token, use the paid chain_token_security tool. No payment required.

無需輸入參數。

版本歷史

5
  1. v0.1.7最新Nov 4, 2026
  2. v0.1.6Oct 31, 2026
  3. v0.1.5Oct 29, 2026
  4. v0.1.4Oct 22, 2026
  5. v0.1.1Oct 19, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Greyridgesignals 整合

US Business Verification MCP Server

ai.greyridgesignals

比對美國州政府官方登記資料庫核驗企業，並以 OFAC 制裁名單篩查，回傳附評分與來源的紀錄。

Streamable HTTP可網頁執行驗證方式
安全與監控需要憑證Nov 7, 2026

Web Extract MCP Server

由 GitHub 帳號 rezearcher 發布

託管型 MCP 伺服器，讓助理把即時網頁讀成乾淨文字、篩檢提示注入，並從網站地圖列出網站頁面。

Streamable HTTP可網頁執行
網頁搜尋與抓取3 個工具Nov 1, 2026

Multi-ATS Jobs MCP Server

由 GitHub 帳號 rezearcher 發布

託管型 MCP 伺服器，讓助理跨七個招募系統搜尋即時、統一格式的職缺，並預覽公司網域資訊。

Streamable HTTP可網頁執行
網頁搜尋與抓取5 個工具Oct 30, 2026

Company Enrichment MCP Server

由 GitHub 帳號 rezearcher 發布

把公司網域變成即時充實記錄：公司概況、聯絡方式、技術棧與基於 8 個 ATS 的招募訊號，含免費預覽與付費深度層。

Streamable HTTP可網頁執行
網頁搜尋與抓取3 個工具Oct 30, 2026

Cve Triage

由 GitHub 帳號 rezearcher 發布

一個遠端 MCP 伺服器，結合 EPSS 評分與 CISA KEV 清單對 CVE 進行分級，給出漏洞利用優先順序，依查詢計費。

Streamable HTTP可網頁執行
安全與監控尚未收錄Oct 24, 2026